
Research
/Security News
Mini Shai-Hulud Campaign Hits Red Hat Cloud Services npm Packages
A mini Shai-Hulud campaign compromised Red Hat Cloud Services npm packages to steal developer and CI/CD secrets during installation.
Turnkey temporal context graph (Graphiti 1:1 port) on libsql. Uses your local Claude Code CLI — no API keys. Single bunx command. MCP + HTTP + CLI.
Docs: https://anentrypoint.github.io/bungraph/
Turnkey temporal context graph on libsql for AI agents. A 1:1 JavaScript port of Graphiti built on:
vector_top_k) + FTS5 keyword search. Zero external servers.Xenova/all-MiniLM-L6-v2 (384d) via transformers.js. No API keys.claude CLI (claude -p). Set BUNGRAPH_LLM_PROVIDER=acp + BUNGRAPH_ACP_COMMAND="opencode acp" (or any Agent Client Protocol agent: kilo, gemini-cli, custom) to route all extraction/dedupe/summary calls through an ACP stdio subprocess via @agentclientprotocol/sdk. Long-lived session, mutex-serialized turns, auto-allow permissions, JSON output parsed from streamed agent_message_chunk text.One command, three modes. Default is MCP.
# MCP stdio server (default — for Claude Code, Cursor, IDE plugins)
bunx bungraph
# or explicit:
bunx bungraph --mcp
# HTTP REST server (graphiti upstream server parity)
bunx bungraph --serve --port 8000
# CLI one-shots
bunx bungraph add "Alice Johnson joined Acme Corp as a software engineer in March 2024." --source text
bunx bungraph search "What is Alice's current role?"
Register as a permanent MCP server:
claude mcp add -s user bungraph -- bunx bungraph
Ingestion: add_episode, add_episode_bulk, add_triplet
Search: search, search_nodes, search_facts, search_communities, search_episodes — all accept as_of for bitemporal queries
Retrieval: get_episodes, get_node, get_edge, get_episode
Communities: build_communities, remove_communities
Sagas: create_saga, summarize_saga
Mutation: delete_episode, delete_entity_edge, delete_entity_node, clear_graph
Observability: debug_state — returns in-process subsystem snapshot (tx stats, writer mutex, LLM inflight, embeddings cache, store URL)
All tool inputs validated with strict zod schemas; unknown keys rejected. Every tool returns structuredContent alongside human-readable content; failures return RFC 9457-style problem descriptors.
POST /messages · POST /entity-node · DELETE /entity-edge/:uuid · DELETE /group/:gid · DELETE /episode/:uuid · POST /clear · POST /search (accepts as_of) · GET /entity-edge/:uuid · GET /episodes/:gid · POST /get-memory · POST /build-communities · POST /triplet · GET /healthcheck · GET /debug/state
Errors conform to RFC 9457 application/problem+json: {type, title, status, detail, issues?}. Bodies capped at 4 MB; invalid JSON returns 400; validation failures surface zod issues.
Every edge carries valid_at (when the fact became true in the world) and expired_at (when the system learned it was no longer true). Search accepts as_of: <ISO-8601> and returns only edges active at that moment:
await graph.search('who does Alice work for', { asOf: '2024-06-01T00:00:00Z' });
Transaction safety: every multi-statement upsert runs through withTx with BEGIN IMMEDIATE semantics + writer mutex + jittered SQLITE_BUSY retry (up to 8 attempts, exponential backoff capped at 2s).
| env | default | purpose |
|---|---|---|
BUNGRAPH_LOG_LEVEL | info | trace/debug/info/warn/error/silent |
BUNGRAPH_LLM_MAX_ATTEMPTS | 5 | retry budget for claude-cli failures |
BUNGRAPH_LLM_TIMEOUT_MS | 60000 | per-call timeout |
BUNGRAPH_LLM_BACKOFF_CAP_MS | 20000 | max backoff between retries |
BUNGRAPH_CLAUDE_BIN | auto-detect | override path to claude binary |
BUNGRAPH_LLM_PROVIDER | claude-code | claude-code or acp |
BUNGRAPH_ACP_COMMAND | — | ACP agent stdio command, e.g. opencode acp, kilo acp, gemini acp |
BUNGRAPH_ACP_ARGS | — | extra args (JSON array or space-separated) appended to command |
BUNGRAPH_DEBUG_ACP | off | log ACP subprocess stderr |
BUNGRAPH_STUB_EMBEDDINGS | off | stub deterministic vectors for offline tests |
BUNDAG_SKIP_LLM | off | skip LLM-dependent branches of test.js |
Logs are JSON lines on stderr with subsystem routing; API keys and authorization/apiKey/token/secret/password/bearer fields redacted automatically.
Each episode goes through:
vector_top_k, exact/loose-name match first, then LLM dedupe promptexpired_at + invalid_at setMENTIONS edges created from episode to each resolved nodeHAS_EPISODE + NEXT_EPISODE), community refreshCombines vector_top_k (F32 cosine) + FTS5 (BM25) via Reciprocal Rank Fusion. Rerankers: rrf, mmr, node_distance, episode_mentions, cross_encoder (via ACP).
16 recipes available from upstream: NODE_HYBRID_SEARCH_RRF, NODE_HYBRID_SEARCH_MMR, NODE_HYBRID_SEARCH_NODE_DISTANCE, NODE_HYBRID_SEARCH_EPISODE_MENTIONS, NODE_HYBRID_SEARCH_CROSS_ENCODER, EDGE_HYBRID_SEARCH_* (5 variants), COMMUNITY_HYBRID_SEARCH_* (3 variants), COMBINED_HYBRID_SEARCH_* (3 variants), EPISODE_HYBRID_SEARCH_RRF.
| Aspect | Graphiti (Python) | bungraph |
|---|---|---|
| Graph DB | Neo4j / Kuzu / FalkorDB / Neptune | libsql (single file) |
| Vector | Provider-specific | libsql F32_BLOB + vector_top_k |
| Keyword | Provider-specific (Lucene/FTS) | libsql FTS5 |
| LLM | OpenAI / Anthropic / Gemini / Groq SDKs | local claude -p (no keys) |
| Embeddings | OpenAI / Voyage / Gemini / HF | transformers.js local (offline) |
| Cross-encoder | OpenAI / BGE / Gemini | local claude -p |
| Runtime | Python 3.10+ | bun / node 18+ |
The site at https://anentrypoint.github.io/bungraph/ is built by GitHub Actions from docs-src/ on every push to main. It uses flatspace as the build tool, the 247420 design system for styling (docs-src/theme/assets/), and vendors webjsx + rippleui locally — no CDN, no external network at runtime.
To build locally:
npx flatspace build # reads flatspace.config.mjs, writes docs/
Content lives in docs-src/content/ as YAML. The theme is in docs-src/theme/.
Apache-2.0
FAQs
Turnkey temporal context graph (Graphiti 1:1 port) on libsql. Uses your local Claude Code CLI — no API keys. Single bunx command. MCP + HTTP + CLI.
The npm package bungraph receives a total of 40 weekly downloads. As such, bungraph popularity was classified as not popular.
We found that bungraph demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
A mini Shai-Hulud campaign compromised Red Hat Cloud Services npm packages to steal developer and CI/CD secrets during installation.

Research
/Security News
The North Korean malware loader hides in a Packagist-listed package and its GitHub branch to fetch and execute remote code in a likely Contagious Interview-style lure.

Security News
The Rust project is moving toward formal rules on LLM use in contributions after months of internal debate over maintainer burden, code quality, and contributor experience.